Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the computer/browser was previously marked as trusted). I'm having trouble to find more information about the subject, in particular on how to implement it securely, if possible at all.

(Note: I refer specifically to general-purpose sites, that rely on nothing special beyond the browsers' capabilities. My bank site for instance uses its own security module (using either Java or ActiveX), but that's beyond the scope of this question.)

Assumptions:

  • The computer to be marked as trusted is indeed only used by trusted people, and reasonable measures are taken to keep it malware-free.
  • SSL is used to communicate to the site.

Questions:

  1. From what I could make of it, a cookie is used to store some arbitrary shared secret between the browser and the site. Is that all? Or does it employ some unique (an un-forgeable) way of uniquely identifying that particular computer or device?

    • In case it's really arbitrary, what properties does it need to be resistant to collisions and/or forgery? (length, randomness, ...)
  2. Should the state of "trusted" expire at some point? Or is it enough to offer means to revoke it on demand, in case the user believes the computer/device was compromised?

  3. Does it actually add any increased security? Using Google example again, I noticed it periodically requests me to authenticate again (using only username/password though). What's the reasoning behind this?

    • If it assumes the computer is still trusted, couldn't it just keep me authenticated forever?
    • If OTOH it assumes a malicious user might be using it, shouldn't it request a full authentication instead? (i.e. why it assumes just the password is enough? does it consider the computer itself to be the second factor?)

    I understand that, generally speaking, when the convenience goes up the security goes down. My doubt is whether or not this option defeats the purpose of two factor authentication, or it's indeed a reasonable compromise.

share|improve this question
1  
I think your 3rd question can't be answered in the abstract; it's too broad, so the answer is "it depends". You have to look at the details of how a specific web site uses the feature, to do a security analysis. Different sites use "remember me"/"trust this computer" differently, and that will lead to different security tradeoffs. –  D.W. Jan 9 '13 at 6:57
    
@D.W. you're right, this part is better left unanswered indeed. I gave one example, but now that you mentioned the "remember me" feature, I recall having seen other scenarios where the convenience feature (be it auto-login or single-factor login) could be voided depending on how important the user intended action was. So I agree it really depends on the circumstances. –  mgibsonbr Jan 9 '13 at 7:42

1 Answer 1

up vote 4 down vote accepted

Yes, the "remember me"/"trust this computer" option is safe to use, as long as you trust everyone else who might have access to your computer, and as long as it is implemented correctly.

It is generally implemented using a persistent cookie. The cookie contains a random, unguessable token that identifies you securely. If the website is implemented properly, it is sent over SSL and the cookie is marked secure. However, many websites omit this step and send it over non-SSL connections (which is insecure if you ever use your computer over an insecure communication medium, e.g., over an insecure Wifi link) or forget to add the secure flag to the cookie (which is not secure against an active man-in-the-middle attack if you are using an insecure Wifi link).

This cookie can optionally have an expiration date, or can be expired server-side. That's up to the web server. Probably there is no great need to expire it, but you could expire it if it makes you feel more comfortable.

This feature adds a great deal of convenience, as it spares you from having to go through certain authentication steps. The exact details of the security/convenience tradeoff and the security benefits will depend upon exactly how a particular web site uses the "remember me" feature, and cannot be answered generically in the abstract.

For instance, many websites may use the "remember me" feature so that you will be automatically logged in every time you visit from this same computer, without needing to type in your password. That's convenient. It also means you can reasonably choose a longer password: since you rarely have to enter in the password, you can make it as long as you want without worrying about the inconvenience of trying to memorize or type in the password. So, in some sense, this does provide some security benefits.

share|improve this answer
1  
A server side expiration option also allows for a 'forget me everywhere' button, thereby allowing the user to expire cookies for all previously trusted computers. –  Jacco Jan 10 '13 at 10:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.